On 11/5/25 17:22, Aleksei Oladko wrote: > In mount operations, cgroup device access permissions are checked only > when a new super_block is created. If the device has already been mounted, > no permission check is performed since the super_block already exists. > As a result, a process belonging to a cgroup without access permissions > to the device can still perform a mount operation successfully. > > To reproduce: > # mount /dev/loop0 /mnt/test0 > # echo $$ > /sys/fs/cgroup/machine.slice/CTID/cgroup.procs > # mount /dev/loop0 /mnt/test1 > # > > If the device was not mounted before, the mount operation fails > as expected: > # echo $$ > /sys/fs/cgroup/machine.slice/CTID/cgroup.procs > # mount /dev/loop0 /mnt/test1 > mount: /mnt/test1: permission denied. > > This patch adds a cgroup permission check for the mounting process > before obtaining the device's super_block. As a result, even if the > device has already been mounted and the super_block exists, the mount > operation will be denied when the process lacks the appropriate cgroup > permissions. > > https://virtuozzo.atlassian.net/browse/VSTOR-105978 > > Signed-off-by: Aleksei Oladko <[email protected]> > --- > block/blk.h | 1 - > fs/nilfs2/super.c | 2 +- > fs/super.c | 14 +++++++++++++- > include/linux/blkdev.h | 1 + > include/linux/fs.h | 1 + > 5 files changed, 16 insertions(+), 3 deletions(-) > > diff --git a/block/blk.h b/block/blk.h > index c718e4291db0..8610d87e5050 100644 > --- a/block/blk.h > +++ b/block/blk.h > @@ -727,7 +727,6 @@ static inline void bio_issue_init(struct bio_issue *issue, > void bdev_release(struct file *bdev_file); > int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder, > const struct blk_holder_ops *hops, struct file *bdev_file); > -int bdev_permission(dev_t dev, blk_mode_t mode, void *holder); > > void blk_integrity_generate(struct bio *bio); > void blk_integrity_verify(struct bio *bio); > diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c > index eca79cca3803..9ee186478575 100644 > --- a/fs/nilfs2/super.c > +++ b/fs/nilfs2/super.c > @@ -1210,7 +1210,7 @@ nilfs_get_tree(struct fs_context *fc) > if (err) > return err; > > - s = sget_dev(fc, dev); > + s = sget_dev_check(fc, dev); > if (IS_ERR(s)) > return PTR_ERR(s); > AFAIK, we don't (plan to) use nilfs2 in our product, so we can drop this hunk. (May simplify rebase in future.) > diff --git a/fs/super.c b/fs/super.c > index b8da7df103b3..514573da3ecb 100644 > --- a/fs/super.c > +++ b/fs/super.c > @@ -1405,6 +1405,18 @@ struct super_block *sget_dev(struct fs_context *fc, > dev_t dev) > } > EXPORT_SYMBOL(sget_dev); > > +struct super_block *sget_dev_check(struct fs_context *fc, dev_t dev) > +{ > + int ret; > + > + blk_mode_t mode = sb_open_mode(fc->sb_flags) | BLK_OPEN_MOUNT; > + ret = bdev_permission(dev, mode, fc); > + if (ret) > + return ERR_PTR(ret); > + return sget_dev(fc, dev); > +} > +EXPORT_SYMBOL(sget_dev_check); > + > #ifdef CONFIG_BLOCK > /* > * Lock the superblock that is holder of the bdev. Returns the superblock > @@ -1662,7 +1674,7 @@ int get_tree_bdev_flags(struct fs_context *fc, > return error; > } > fc->sb_flags |= SB_NOSEC; > - s = sget_dev(fc, dev); > + s = sget_dev_check(fc, dev); > if (IS_ERR(s)) > return PTR_ERR(s); Can we now remove BLK_OPEN_MOUNT-related hunk in setup_bdev_super which does same exact check again in case of new superblock creation? > > diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h > index 030242b56e04..0bbb65885692 100644 > --- a/include/linux/blkdev.h > +++ b/include/linux/blkdev.h > @@ -1660,6 +1660,7 @@ struct file *bdev_file_open_by_path(const char *path, > blk_mode_t mode, > int bd_prepare_to_claim(struct block_device *bdev, void *holder, > const struct blk_holder_ops *hops); > void bd_abort_claiming(struct block_device *bdev, void *holder); > +int bdev_permission(dev_t dev, blk_mode_t mode, void *holder); > > /* just for blk-cgroup, don't use elsewhere */ > struct block_device *blkdev_get_no_open(dev_t dev); > diff --git a/include/linux/fs.h b/include/linux/fs.h > index b6f7809cad29..1f535909524c 100644 > --- a/include/linux/fs.h > +++ b/include/linux/fs.h > @@ -2608,6 +2608,7 @@ struct super_block *sget(struct file_system_type *type, > int (*set)(struct super_block *,void *), > int flags, void *data); > struct super_block *sget_dev(struct fs_context *fc, dev_t dev); > +struct super_block *sget_dev_check(struct fs_context *fc, dev_t dev); > > /* Alas, no aliases. Too much hassle with bringing module.h everywhere */ > #define fops_get(fops) ({ \ -- Best regards, Pavel Tikhomirov Senior Software Developer, Virtuozzo. _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
